Overview

overview

10

Static

static

3

mod_batsty.exe

windows7-x64

1

mod_batsty.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    mod_batsty.exe

  • Size

    332KB

  • Sample

    241223-l3ma4aymal

  • MD5

    f4d32ca0fe636646b5689b134e3929da

  • SHA1

    6255ce4bfb52ce67cbc5c8fdbf9fc110829f4b36

  • SHA256

    acc11eadcbde58d7ac2be682fc55752b1c6f0467c85d9d1e477c60f31b56fcfb

  • SHA512

    3d407f6f27f9481758e8a57e1e216898b429140b476d51ebab52a057ba8df0e2a41b9034dd087f3ed2baea04a0b0ddfe8f8dc06dbb8ece8e0a56a93d531befb1

  • SSDEEP

    6144:elbkAxgL/r0JTy6x2kGU/fHyB7qMH9O1BNI:e9kAxgL/YTyuDDxMo7I

Score
10/10
asyncratdec-feder.derat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

DEC-feder.de

C2

treppen.duckdns.org:4099

treppen.duckdns.org:5801

fahrzeugtechnik24zusatzfeder.de:4099

fahrzeugtechnik24zusatzfeder.de:5801
Mutex

jjmpUc2FRK2J

Attributes
  • delay

    3

  • install

    false

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      mod_batsty.exe

    • Size

      332KB

    • MD5

      f4d32ca0fe636646b5689b134e3929da

    • SHA1

      6255ce4bfb52ce67cbc5c8fdbf9fc110829f4b36

    • SHA256

      acc11eadcbde58d7ac2be682fc55752b1c6f0467c85d9d1e477c60f31b56fcfb

    • SHA512

      3d407f6f27f9481758e8a57e1e216898b429140b476d51ebab52a057ba8df0e2a41b9034dd087f3ed2baea04a0b0ddfe8f8dc06dbb8ece8e0a56a93d531befb1

    • SSDEEP

      6144:elbkAxgL/r0JTy6x2kGU/fHyB7qMH9O1BNI:e9kAxgL/YTyuDDxMo7I

    Score
    10/10
    asyncratdec-feder.derat

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

      ratasyncrat

    • Asyncrat family

      asyncrat

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Async RAT payload

      rat
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks